Get 20M+ Full-Text Papers For Less Than $1.50/day. Start a 14-Day Trial for You or Your Team.

Learn More →

In their own words: employee attitudes towards information security

In their own words: employee attitudes towards information security PurposeThe purpose of this study is to uncover employee attitudes towards information security and to address the issue of social acceptability bias in information security research.Design/methodology/approachThe study used personal construct psychology and repertory grids as the foundation for the study in a mixed-methods design. Data collection consisted of 11 in-depth interviews followed by a survey with 115 employee responses. The data from the interviews informed the design of the survey.FindingsThe results of the interviews identified a number of themes around individual responsibility for information security and the ability of individuals to contribute to information security. The survey demonstrated that those employees who thought the that organisation was driven by the need to protect information also thought that the risks were overstated and that their colleagues were overly cautious. Conversely, employees who thought that the organisation was driven by the need to optimise its use of information felt that the security risks were justified and that colleagues took too many risks.Research limitations/implicationsThe survey findings were not statistically significant, but by breaking the survey results down further across business areas, it was possible to see differences within groups of individuals within the organisation.Originality/valueThe literature review highlights the issue of social acceptability bias and the problem of uncovering weakly held attitudes. In this study, the use of repertory grids offers a way of addressing these issues. http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png Information & Computer Security Emerald Publishing

In their own words: employee attitudes towards information security

Ashenden, Debi
Information & Computer Security , Volume 26 (3): 11 – Jul 9, 2018
Download PDF
11 pages

Loading next page...
 
/lp/emerald-publishing/in-their-own-words-employee-attitudes-towards-information-security-E43M6Qtw0V
Publisher
Emerald Publishing
Copyright
Copyright © Emerald Group Publishing Limited
ISSN
2056-4961
DOI
10.1108/ICS-04-2018-0042
Publisher site
See Article on Publisher Site

Abstract

PurposeThe purpose of this study is to uncover employee attitudes towards information security and to address the issue of social acceptability bias in information security research.Design/methodology/approachThe study used personal construct psychology and repertory grids as the foundation for the study in a mixed-methods design. Data collection consisted of 11 in-depth interviews followed by a survey with 115 employee responses. The data from the interviews informed the design of the survey.FindingsThe results of the interviews identified a number of themes around individual responsibility for information security and the ability of individuals to contribute to information security. The survey demonstrated that those employees who thought the that organisation was driven by the need to protect information also thought that the risks were overstated and that their colleagues were overly cautious. Conversely, employees who thought that the organisation was driven by the need to optimise its use of information felt that the security risks were justified and that colleagues took too many risks.Research limitations/implicationsThe survey findings were not statistically significant, but by breaking the survey results down further across business areas, it was possible to see differences within groups of individuals within the organisation.Originality/valueThe literature review highlights the issue of social acceptability bias and the problem of uncovering weakly held attitudes. In this study, the use of repertory grids offers a way of addressing these issues.

Journal

Information & Computer Security – Emerald Publishing

Published: Jul 9, 2018

References

  • Users are not the enemy
  • A qualitative study of users’ view on information security
  • What do they really think? Overcoming social acceptability bias in information security research
  • Can we sell security like soap? A new approach to behaviour change
  • CISOs and organisational culture: their own worst enemy?